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See Attachment 8. 


The bflsis for die search ttnder Fed. R. Crlitt. -41(c) Is {KJt^kefne 
^ evidence of orime: 

^ contraband, fruits ofcriine* or other items {lleg;alty possessed; 

^ property tlesigried for use* bonded for use, or used in committing a crime; 
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riie appjicadon is based on these ftci$: 


'flf Continued on the atii»c;hod sheet, 
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Ciiy and state: Mobile. Alabama KATHERINE P NELSON, United States Magistrate Judge 
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AFFIDAVIT IN SUPPORT OF AN 
APPLICATION UNDER RULE 41 FOR A 
WARRANT TO SEARCH AND SEIZE 

being Hfst duly swotti. hereby depose and slate as follows; 

INTRODUCTION AND AGENT BACKGROUND 

■■h H ■■ ■ ■ ■ ■ ■ li I j I :B-Xhli I I l l ■ Chilli! I III I i i i J^IbI i:^ 

K i make thk alTtdiivit in support of an application under R.ule 41 of the federal 
Rules ofCdmmal Pfoccdurc fora search warrant authorizing ihc e^camination of pi’opoity* 
nanicly. three (3) elecUonic devices, which arc curtemJy in law entbreement possession, and the 
extinction of electron led ly stored infomiaiion described hi Attachment 1^. 

2> I am a Special Agent with ihe Pederai Bureau of Invesugation. 1 am a law 
enfQa:errtent olficer of the United States w ho is empowered h> (aw' to conduct invesilgaiiorsfi of 
and TO make airosts for oB’enses against the United Stales, I have been employed by tile FBt (or 
fv monthsi. During my tenure with the f 0(, J have been assigned mvesligations dealiihg with 
insurance fraud, wire fraud, identity tiicrt^ and public corruption. Through my training, 
education and experience^ 1 iiavc become fatiiiitar with the manner in whicit offenders 
communicale using e-mail, social media, and the imernet to iransmit, share or store evidence of 
cri lives, 

3, This alTidavit is intended to show only that there is surflciem probabie cause for 
the rcc[Ltesicd wairant and does not sei forth ail of my kiiowiedge about this matter. 


I 
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4. To thirty-six, grand jury subpoenas have been served to various banks and 
insurance carriers bdicved to have done business with 'niotnas E. Bums or Tommy Burns 
Agency, LLC, Additionally, several alleged victims and an employee of Tommy Burns Agency, 
LLC have provided some documents related to Thomas E. Bums and/or Tommy Bums Agenev. 
LLC. While some documents received from these entities provide potential evidentiary value, 
they constitute an incomplete record of suspected illicit business dealings perpetrated by Thomas 
E. Bums, The warrant 1 apply for today would allows seizure of the additional information not yet 
obtained by investigators associated with this ease. 

PROBABLE CAUSE 

1. On December 4, 2018, the Mobile Field Office of the Federal Bureau of 
investigation received a walk-in Complaint from Orange Beach, .AL resident Katheryn Scott that 
Thomas Edward BumsdbaTomnty Bums Agency. LLC was collecting insurance premiums from 
customers and not paying policy premiums to the underwriter. South Shore Insurance Underwriters 
(SSIU). 

2. Katheryn Scott works as a part, time accountant for SSIU and operates a business. 
Driftwood investigations. LLC, as a certified fraud examiner. She previously worked as a forensic 
accountant for the Federal Bureau of Investigation in Mobile. AL. In October 2018, Katheryn 
Scott was contacted by her daughter, Mindy Dees. Marketing Director at SSIU, about a pattern of 
non-payment for policies by Tommy Boms Agency, LLC. SSIU was sending cancellation notices 
to cusiomer.s of Bums due to the non-paymertt. ScotTs intemai investigation found that eight out 
of 16 policies hound by SSIU on behalf of Tommy Burns .Agency were cancelled for non-pa vment. 


2 
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3. On March i9, 2Q19, Dennis Wright from the Alabama Department of Insurance 
received a complaint against Tommy Burns Agency, LLC from CRC Insurance Services fCRC), 
parent contpany of Southern Cross Underwriters (SCU). Hie compiaim detailed that SCU bound 
20 policies for Tommy Bums Agency between November 2018 and February 2019 for a total of 
$24J29.00 ii) premiums. As of March 18. 2019, 17 of the policies had not been paid and had 
cancellations issued or expected to be issued. SCU filed the complaint after being contacted hy 
scveral customers of Tommy Burns complaining that they had made full payment to Tommy 
Burns, 

4. On March 21, 3019.1 inieiviewed Carolyn Genry. She had a homeowner's policy- 
paid via escrow to Tommy Bums Agency, LLC. She had received a cancellation notice from SCU. 
When she called SCU, she was told she w'as not able to get her policy reinstated due to non- 
payment. Mrs. Genry confronted Tommy Bums requesting a refund so that she could get a policy 
elsewhere. Mr. Burns did not offer a refund but offered to find Mrs. Genry insurance with another 
underwriter. 

5. On March 22. 2019, I telephotitcally interviewed Melisa ilaltmark. the Vice 
President of Agency Appointments and Administration with CRC Insurance Services (CRC), the 
parent company of Southern Cross Underwriters (SCU). Prior to March 18, 20 i 9, several .insured 
customers called the SCU office in Mississippi after having received policy cancellation notices. 
This was abnormal because SCU did not normally deal directly with insured. SCU is a brokerage 
that collected payments from agents and placed them vvith insurance exchanges. All the insured 
individuals that contacted SCU Jiad applied for policies through Tommy Burns Agency, LLC. 
Each claimed they made full payments to Burns. SCU had 12 policies pending cancellation for 
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I 


ncn-py> meal of premiums with live more c\pecicd to be issued. The total unpaid premiums before 
u)minls^ien vva*? SI6^98332. SCU coitiTUuiiicated viactnaU with theI'onimy fiunis Agency* LLC 

L 

at lumiTiy@tonimybiirnsagency*com. Tommy Burns Agency^ LLC received a written nattce from 
see sent on March 4. 2019 detailing 16 out of i 9 accounts past due totaling 9,01 3 , 5 f 3 . 

6p On March 22^ 2019, Special Agentand J interviewed Warda 
Stewart Tumei' (Turner]. Turner is the daUgliter of Barkley Stew^n (StevvarE;), aged 9[. On 
December 26.20 1 8, Turner and Stc\vart visited J ommy Bums Agency, LLC and mel w ith Burns, 


Stewarl agreed to a home owner’s insurance policy for one year. Turner wrote a check on Stewart's 
behalf lo lommy Hums Agency, LLC for $1,053,96, In late January or early February 2019, 


Stewart received a letter in the mail from Southern Cross, cbi: insurance under\witer that hiid bound 


the homcownei's polfcy from Bums, ITie fetier stated that Slcwart^s policy was being cancelled 
tbr non-payment. In mld-Febrimry 201Q, Turner made confer with Bums on the phone ond Bums 
promised to write a check lo SCU that day, Burns did wi ite a check the ihOowing day. hiowever, 
an SCI/ representative later told Turner that the dieck had bounced and SicwarTs policy was 
cancelled. Turner filed a ptdice report with the Mobile County ShcritPs Office, 

7, On March 23, 2019, Special I imerviewcd William 

Henry Couch, -lonior (Couch). On September 19,2018, Couch had a check from his Wells Fai^o 

k-p 

escrow account sent to Tommy Bums A^ncy, LLC in the atnousne of SI688.42 for insui-ance 

coverage. That check was cashed bv Bums on September 24, 2018, In (Xtober 2018. Couch 

received a caneellaiion notice from .South Shore Insurance UrMlerwritcr.s (SSIU) stating tliai his 

policy would be cancelled for non-payment effective November 3. 20IS. Couch .sent an email to 

Burns at tommy@tominybiimsagency.com on November 8, 2018 questioning why liis policy w-as 

4 
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cafKsdlcd. Cauch demanded a cash refund which Burns provided later tliat day at Coiieivs pbce 
of work, but m\y after J^urns made Couch sign a document that he would Jio? hajd Bums liable 
tor any losses resuhing from the policy canedlaiion* Couch moved his policy to Ryan Reid 
Agency and paid SSIIJ directly to get his poJjsry' back in force. Couch pmvided Agents with 
printouts ofeioaiJs from Bums to Couch using email address: tommy^^tomrnyinfrnsagencyxoiTi. 
an escrow statement, and a canecllaiiun leiier in support of his allegations. 

S. On March 25. 20Special Agentand ! interviewed Michael 
Dcntics f"Jordy (Mardyk friend of Thomas Burns^ who has known him fbr ahout one year. In 
October 10\K. Burns provided f lardy a homeownci'^s insurance quote that was almost half of what 
Hardy had previously paid for simiLnr coverage. The quote was through South Shore Insurance 
t hidervvi hcr.> (SSIU), Hardy wrote Burns a check for M Q7.7a on 10/1 !/2018. The policy was 
for one year of homeowner's insurance coverage. Hardy laier learned frotti Tomm} Biirtf s office 


assistant, Angela Bassett (Bassett^ that Bums casihed his check at the Cemury Bank adjacent lo 
Bunfs yfllee whhin minutes of Handy depaitin^ Hardy obtained a copy of the cashed check frt^m 
the Ixink. which was endorsed by Bums on ihe back of ihc check. Several months later. Hardv 

V 

received a notice iifeanceHautm letter in the mail from SSIU. Hardy con [acted SSIU and sjxikc 


tn Mindy Decs (IX^c^). Dees toid Hjjrdy that SSIU hml never received payjnctH foi his 
hotii^>\vner"s insumnee policy and therefoni, was eanceltng the policy for non-payment. Dees 
also told Hardy ibai SSIU no longer did business with bums. Bums fold Hardy ih&i he would 


move his policy to a new coinpany. SCU. However^ Hardy never tilted out any applications or 

other documents for SCU. Hardy later contacted SCU and learned that his homeowner's policy 

with them was only valid through March 3L 20BX 

5 
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9. On March 26. 2019, Special imd I ineL with Angda Kay 

McC:onnei] Basscu (Basseci), Bassett curicntK serves as the oOice ossisram at Toinni) Burns 
Agency, Ll-C. Resides Burns, is the cniv other emplo^^e of Tommy Boms Agency. LLC. 

BasseU began working ihcie in early Ociober 2018, Basscvi had no prior knowletlgc of ihc 
insurance huslnessr so she iTcfied on Buitis to teach tier, Bassett knew Ihiil Burns !iad recent!)- 
began moving a number ofinJuraiKc policies IVum Swyfft to South Shore insurance L!ndcrvvritcis 
fSSEU). tn laie Oaobet or early November 2018, one of Bums' SSIU custoiiiers: lYamed I tank 
Thompson (T honipsoa) siiticrcd a grease fire in his home kiiclico. Thompson had paid Boms for 
a onC’Vcaf honieowner^s iitsurance policy through SSJU, However, Bums had not passed on the 
payment lo SSJU. Shortly betbcc Iho lire, SSIU had cancclied Tlicmpson‘s insurance policy for 
non^paynicni. After Thompson notified Bums of the fire and his need to file a dam, B^issexi 
overheard Burns call a rcpm&entative st\ SSIU and ask Ibr Thompson's policy to be reinstated with 
iici loss of coverage. During this phone conversation. Bums did not itiform S8fU that Thompson 
had suffered a kilciten lire and i\m a claim would be IbrThconimg, Burns paid the money owed 
on the pidicy in order to get it reinstoied, SSIU agreed to reinstate the policy, but only beginning 
at !2:01 am the following disy. The nc\t [norning. Bums attempted to submit a claim un 
ThcHixpson's bchali for the kitchen lire. On the claim* Bums changed the dale of the fire to ensure 
pKUTipson would be covered, Bassett also overheard Rums telephone com ci<;tatiort to the Grand 
Bay fire Jepamneni and convinced them that the fire had actually occuired on a differeni day. 
resulting in them issuing an amended report of the fire that falsely reprtfsenied die actual thiieof 

After this iiiddent, Bassett beg^ io notice that Buto often cashed checks ix:ccivcd 

6 


the lire. 
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from cufstomers that was supposed to be for their insurance premiums, but Burns was not 
forwarding the money on to the insurance underwriters. Burns w'ouid often walk next door from 
the office to the Century Bank and cash the checks there. Burns would also go to the banks where 
the customers had their accounts to cash the checks. In November 20 il Burns dircetai Bassett 
to get new policies for all of his SSIU customers, because SSJU had cut him off. Burns had Bassett 
get new quotes !rom a different insurance underwriter, create falsified statements of no loss, and 
generate new policies. Bums then directed Bassett to sign the citstomer's name on the new policy 
applications. Burns told Bassett that it w'as fine and normal to switch the customers insurance 
carrier and that the customer did not need to know. According to Bassett the paper documents 
associated with these transactions were most likely shredded after they wem saved and uploaded 
to the Microsoft OneDrive account from EZlinks. a software program that organizes files, Bassett 
indicated that any remaining paper documentation would be located at the Business, 

11. Despite moving to new insurance undertvritcrs. after about 60 days the insurance 
undei writers still had not been paid and began sending out cancellation notices for non-payment. 
From November 2018 through the present, Bas-sett stated that more and more cu.stomers have come 
to the office to demand their money back, as they had received cancellation notices in the mail. In 
one recent month. Burns took In over $20,000 in premium payments from customers, but did not 
pass any of it on to Insurance underwriters. Bassett is maintaining an active list of people that she 
believes Bums has stolen from. .About three weeks ago, Bassett started turning away new 
customers for fear that they too would be victimized by Burns. Without Burn".s knowledge, 8a.ssett 
told these individuals that they could not take on any new bLi,siness and recommended other 
insurance agents in the area. 


7 
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12, From my micrvk'w with Bassett and from reviewing documems received via 

subpoena. I learned that ihe foilowing individuals and businesses paid their insurance premiums 

to the 7’ommy Burns Agency, but received notices of nonpayment or cancellation notices for 

nonpayment: Caroiyn Genry, Blakely Lamar Stewart, Michael Hardy, Albert Pattai, Charles 

Mercer, Flenry Thompson, William Couch, Jr„ Michelle Pujob. Jon Custer, Johnny Shepherd, 

Gerald Capps, Gloria Capps, Christopher Taylor, Calvin Calhoun, Dan Riley, Joseph Spicciani, 

Jane Spicciani, Shane Sigsbec, Karen Leasurc, Nino Mondsini, Samantha Abpaugh. Amy Switzer, 

Lynda Barker, Aleta Boudreaux, Mark Hale, Traci Hale. Pat Richards. Joseph McGugiji, Lalasha 

Schultz, Thunnan Kittadl. John KiUrcll. Christine McGaliagher, Michael Mail ini, Michaeia 

Hollow^ay, Christopher Hayes, FOCLAB Marine Services, Spicy Group, LLC, Citizens for a Belter 

Grand Bay Library and Museum, and Amy SpiuerProperues, Basset indicated that the doctimcncs 

associated with these customers was stored into Burns' Microsofl OneDrive account. Wliile 

working at the Business, Bums directed Bassett to scan a)! documents into the Microsoft OneDrive 

account that Burns uses to store records and Information related to Tommy Burns Agency, LLC. 

Many documents are abo copied to the Microsoft OneDrive account from LZlinks, a software 

program that organizes Hies. Burns has told Bassett to shred everything once the documents have 

been scanned and uploaded. Bassett believes that Sums does not want to leave a paper trail and 

believes that he would begin deleting files if he thought law enforcement were on to him. Burns 

abo directed Bassett to stop issuing receipts to customers who pay in cash. Basseti indicated that. 

there is an excel spreadsheet to record payments (by both cash and check) received by customm. 

This excel spreadsheet is saved on Bassett's HP computer located at the an the Premises, Burns 

has not shared the Microsoft OneDrive account passwojxi with Basseti. but the account ts always 

S 
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ill oil s dciiktop computer on her desk at the office. Bums occosscs the some 

Micmsoa OneOnve account from the gny IIP bptop on hh at work, in addition* Basseil 
hidicatcid dial 13 unis possessed aL least two additional laptops and an 7 \pple iPhone ediular 
tdcphoik^ that he cajries wicli Jiim when he leaves the Premises. Bas 5 ;eti stated that he often does 


business from his cellular phone and ihat he has across all of the businc.ss rccoicis on OneDrive by 


using his ceiiular phone which is associated with telephone number 251 Burns ieceives 

emails related to the Tommy Rums Agency. LLC on this cellphone. Maiiv individuals often cairv 
their eel luhii telephones on therr person. 

IX Bums drives a silver 2019 Toyota wfiich he rccemly leased nfkr totaling 


his previous vehicle in a single vehicle acdderiL 


He uses this vehicle to iransport his phone and a 


laptop (unidentined make and model) to and froni work. Bum^i' rarely ^rives ai ibe Business 
prior to 1! lOOam. Bassett spited timi Bums showed up for work on Monday* March 25. 2t) i 9* but 
ihnt was the tlrsi time Bums had been to the Premises on a MoiKlay in several months. According 
to Bassett, Bums has spent less and less time at work as the number of custamer’s seeking refntul?^ 
has grown, but continues to run tlie business from his phone and his laptop that Etc irajisporu home 
With him. Bums did spend several hours ai the Premi^ics on March 26,2019. However. Burns did 
not come to the Pnemiscs on March 27.2019. Tiiroughom March 2T^ Bums continued ui call and 
text from his telephone number 25 1 hich is the perstmni cellular number he pmvided 

k) Busseti. and send her email from his email accounts tommy@tommybuFnsageFicy.com. 

and ^^^^^@yahoo.com, from his home at S950 Spring 
Grove South* Mobile. AL 36695. In these commiinicaiions,. Bums directed Basseti to submit 


Severn f new insurance policy applications chi behalf of customers without their knoivfcdge and 

9 
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consetu 10 a ncvv insurance imdcrwnlcr. Basselt did rot submit the p&liciesas duTOeef. 


14, On March 2019, Special Agent 


and I again met with An^iela 


T he meeling occuiTcd at the Premises wheie the business of Tommy Bums Agency, t-LC 
is operated. Bassett provided several documents and additional information. The documctiis 
included a physical copy of an excel spreadsheet, I’lic spreadsheet a partial list of Tomn^y 
Burns Agency. LLC customers v\bo had paid for insurance policies through Tommy Bums 
Agency, U.,C, Bassett used this document la record payments received. The curreni, digital copy 
of this b^xcel spreadsheet h saved an the desktop folder of Baasett's HP desktop compuUT located 
at her desk. Bassctl slated dial all cusLomerK. with one exception, listed on the spreadsheet that 
had homeowner's insiuance through Tommy Burns Agency, LLC had paid their premium for ihe 
policies, but Burns had not forwarded ihe^ money to the appropriate ln,surance underwriter 


15. Bassen also prov idcil a copy of a letter From CRC G roup, the parent company of SC Li, 
with a list of nine insurance policies that were listed as past due and subject to contellation, Bassett 
stated diat alJ of the lisied iudlvyuab had paid Burns for their policies, but Burns had fatted to 
pa,ss on the tmytnents to SCXL except in orte case. 

16, On April 4, 2019, Special Agentand 1 interviewed a focal hiw 
enforcement of ficer with The Mobile Coiinxy Shmfi’‘s Ofllce who was present; during the service 
of a state arrest wan am for Rums on unrelaied charges at Burns' home located at 

Mobile, Alabama 36695, During service of the arrest w^tram, local law enfot cement 

from Mobile County Shedg^s Office saw dittg paraphernalia in plain view. The deputies on scene 

obtained a search warrant for drugs During the course of that search. 

deputies f<.>untl In plain view insurance pH^licy documejiis as well as two laptop eomputets and a 

10 
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cellular phone. Burns provided the passcode to unlock the cellular phone to the deputies. The 
laptops and cellular phone matched the description given by Bassett of those items that Burns 
would use for conducting the business of Tommy Bums Agency. LLC and had taken home with 
him. During the search of the home, deputies seized two (2) lap top computers and the eeliphone 
of Tommy Burns. These electronic devices have now been turned over to the Federal Bureau of 
Investigation pending the issuance of the search warrant requested herein. 

17. Based on my training, experience, and what [ have learned from other law enforcement 
professionals, the affiant submits thenj is probable cause to believe electronically stored evidence 
and insii-umentalities of the crimes of violation Title 18 USC § ! 343, Wire Fraud and Title 18 USC 
g 1033. Insurance Fraud is contained on the electronic devices identified as belonging to fhomas 
bdward Bums and Tommy Burns Agency. LLC, to include, but not limited to, communications 
with clients, insurance applications, cancellation notices, payment records and bank and/financiai 
records related to the deposit of premiums. 

IS. 1 hereby state that upon oath that the foregoing tnfomiaiion is true to the be,si of my 
knowledge and belief. 

19. .1 seek this warrant to be certain that the seizure and examination of the devices 

will comply with the Fourth Amendment and other applicable laws. 

TECH.MTCAL TERMS 

Ba.sed on my training and experience, I u.se the follow ing technical terms to 
eon.vc3’ the fol lowing meaning.s: 


II 
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a. IP Address; Tlie Internet Protocol address (or simply "IP address") is a unique 
numeric address used by computers on the Internet. An IP.address looks like a 
series of four numbers, each in the range 0-255, separated by periods (e.g., 

• 12! ,56.97. i 78). Every computer attached to the Iniernet must be assigned an IP 
address so that bitemet traffic sent from and directed to that computer may be 
directed properly from its source to its destination. Most Internet service 
providers control a range of IP addresses. Some computers have static—^lliat is, 
long-term—IP addresses,, while other computers have dynamic—that is, 
frequently changed—IP addresses. 

b. Internet: The Internet Is a global network of computers and other electronic 
devices that comnninicaie with each other. Due to the structure of the Internet, 
connections between device,s on the Imernet often cross state and international 
borders, even when the devices communicating witli each other are in the same 
state, 

c. Storage medium: .A storage medium is any physical object upon which computer 
data can be recorded. Examples include hard disk.s. R..AM, floppy disks, flash 
memory/thumb drives, CD-ROMs, and other magnetic or optical media. 

COMPUTERS. ELECTRONIC STORAGE. AND FORENSfC AiVAr.VSlS 

6. As desc ri bed above and i n A tiacii ment 8, th is app 1 ication seeks perm issi on to 
search for records that might be found on the PREMISES, in whatever form they arc found. One 
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form in which the records might be found is data stored on a computer's hard drive or other 
storage media. Tlius, ihe warrant applied for would authorize the seizure of electronic storage 
media or. potentially, the copying of electronically siored information, all under Rule 
41(e)(2)(B). 

7. Probable cause, i siibmii that if a computer or storage medium is found on the 
PREMISES, there is probable cause to believe those records will be stored on that computer or 
storage medium, for at least the following reasons: 

a. Based on my knowledge, training, and experience, 1 know that computer tiles or 
remnants of such files can be recovered months or even years after they have been 
downloaded onto a storage medium, deleted, or viewed via the Internet, 

Electronic Hies downloaded io a storage medium can be stored for years at little 
or no cost Even when files have been deleted, they can be recovered maiilhs or 
years later using foi^nsic tools. This is so because when a person "\leleies“ a file 
on a computer^ the data contained in the file does not actually disappear: mther, 
that data remains on the stomge medium until it is ovemrilten by new data, 

b. riiereforc. deleted files, or remnants of deleted files, may reside in free space or 
slack space—iliat is, in space on the storage medium that is not currently being 
used by an active file—for long periods of time before they are overwritten. In 
addition, a computer's operating system may also keep a record of deleted data in 
a '"swap'' or ''recovery" file. 


13 
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c. Wholly apart from user-generated files, computer storage media—in pariicuiar, 
computers* internal hard drives—contain electronic evidence of how a computer 
has been used, what il has been used for, and who has used it. To give a lew 
examples, this forensic evidence can take the form ofoperating system 
configurations, artifacts from operating system or application operation, file 
system data structures, and vbtua) memory "'swap*' or paging files. Computer 
usd's typically do not erase or delete this evidence, because special sSofiware h 
typically required for that task. However, it is technically possible to delete this 
information. 

d. Similarly, files that have been viewed via the Internet are sometimes 
automatically downloaded into a temporary Imemel directory or ''cache/* 

c. Based on actual inspection of other evidence related to this investigation, 

including spreadsheets, financial records, and insurance policy applications, ! am 
aware that computer equipment was used to generate, store, and print documents 
iisSed in the wire and insurance fraud schemes. There is reason to believe that 
there is a computer system currently located on the PREMISES. 

8. Forensic evidence. As finlhcr described in Attachment B, this application seeks 
permission to locate not only computer files that might serve as direct evidence of the crimes 
described on the warrant, but also for forensic electronic evidence that establishes how 
computers were used, the purpose of their use, who used them, and when. There is probable 
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cause to believe ihat this forensic electronic evidence will fee.on any storage medium in the 
PREMISES because; 

a. Data on the storage medium can provide evidence of a file that was once on the 
storage medium but has since been deleted or edited, or of a deleted portion of a 
file (such as a paragraph that has been deleted from a vi'ord processing file). 
Viiiuai memory paging systems can leave traces of information on the storage 
medium that show what tasks and processes v^ere recently active. Web browsers, 
e-mail programs, and chat programs store configuration information on the 
storage medium that can reveal informaiion such as online nicknames and 
passwords. Operating systems can record additional information, such as the 
attachment of peripherals, the attachment of USB flash storage devices or other 
e.\ternal storage media, and the times the computer was in use. Computer file 
systems can record information about the dates files were created and the 
sequence in which they were created, although thi.s information can later be 
falsified. 

b. As explained herein, information stored wlthiJi a computer and other electronic 
storage media may provide crucial evidence of the "who. what, why. when, 
where, and how" of the criminal conduct under investigation, thus enabling the 
United Slates to establish and prove each element or alternatively, to exclude the 
innocent from fiiither suspicion. In my training and e.xpcricnce, inrorniation 
.stored within a computer or storage media (e.g., regi,stry information. 
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comniui^ications, images ajid movies, transactionai infonnation. records of 

session times and dui'acions. iiiteme£ history, and anli-virus. spywai^^ and 

maiware deleclion programs) can indicate who has used or controlled the 

computer or storage media, Tliis "user auribulion"' evidence is analogous to the 

search for “indicia of occupancy" while executing a search warrant at a residence. 

The existence or absence of anti-virus, spyware, and malware detection programs 

may indicate whether the computer was remotely accessed, thus inculpating or 

exculpating llie computer owner. Further, computer and stoi'age media acti vilv 

can indicate Ijow and when the computer or storage media was accessed or used. 

For example, as described herein, computers typically contain information that 

log: computer user account session times and durdiians, computer acuvity 

associated with user accounts, electronic storage media that connected with the 

computer, and the IP addresses thmugh which the computer accessed networks 

and the internet. Such informatioivallows investigators to understand the 

clironoiogicai context of computer or ckclronic storage media access, use, and 

events relating io the crime under investigation. Additionally, some information 

stored wiihin a computer or electronic storage media may provide crucial 

evidence relating to the physical loeatton of other evidence and the suspect. For 

example, images stored on a computer may both show a particular location and 

have geolocation information incorporated into its Hlc data. Such Hie data 

typically also contains information indicating wlien the file or image was created. 

The existence of such image tiles, along with externa! device connection logs, 
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may also indkate the presence of additional electronic media a 

digital camera or cellular phone with an incorporated camera). The geographic 
and timeline mfonnation described herein may either inculpate or exculpate the 
computer user Last, information stored within a computer may provide relevant 
insight into the computer user's state of mind as it relates to the offense under 
investigation. For example, informaiton within the computer may indicate the 
owners motive and intent to commit a crime (e.g., internet searches indicating 
criminal planning), or consciousness of guilt (e.g., running a ''wiping'" progmm to 
destroy evidence on the computer or password proiecting/encrypUng such 
evidence in m effort to conceal ic from law enfoiicemem), 

c, A person with appropriate familiarity with how a computer works can. after 
examining this forensic evidence in ks proper contexL draw conclusions ubom 
how eoinpiiters were used, the purpose of their use, who used them, and when. 

d. The process of identifying the exact files, blocks, registry entries, logs, or other 
forms of forensic evidence on a storage medium that are necessary^ to draw an 
accurate conclusion is adynamic process. While it is possible to specify in 
advance the records to be sought, computer evidence is not always that can 
be merely reviewed by a review team and passed along to investigators. Whether 
data stored on a computer Is evidence may depend on other inlbrmation stored on 
the computer and the application of knowledge about how a computer behaves. 
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Therefore* informanon necessary to iindersland other evidence also 

falls within die scope of the warrant* 

e* Further in finding evidence of how a computer was used, the purpt^sc of its use, 
who used iu and when, sometimes h is necessary to establish that a particular 
thing h not present on a stonige: medium* For example* the presence or absence 
orcoiinter-forcnsic programs or anti-virus programs {and associated dam) may be 
relevant to establishing the user's intent 

f ] know that when art individuai uses a computer to transmit falsified, forged, or 
unauthorized documents, the individuaf s computer will genemlJy serve botli as 
an Instrumentality forcommiulng the crime, and also as a storage medium for 
evidence of ihe crime. The computer h an insirumcntahty of ihe crime because it 
is used as a means of committing the criminal oftense* The computer is also 
likely to be a storage medium for evidence ofcrime* From my truining and 
experience, I believe that a computer used to commit a crime of this type may 
contain: data that is evidence of how the computer w as used; data that was sent or 
received: notes as to how the criminal conduct w^as achieved; records of Internet 
discussions about the crime; and other records that indicate the nature of the 
offense* 

9- Necessiiy ofseizmg or copying eniire cxmiputcrs or siorage mcdicr In most cases. 

a thorough search of a premises for information that might be stored on storage media often 

requires the seizure of the physical storage media and later off-site review consisiem with the 
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warrant. In Vim of removing storage media tram the premises, it is sometimes possible to make 
an image copy of storage media. Generally speaking, imaging is the taking of a complete 
electronic picture of the computers data, including all hidden sectors and deteied files, Biiher 
seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded 
on the storage media, and to prevent the loss of the data either from accidental or liitcnLioiial 
destruction. This is imc because of the following: 

a. The time requii'ed for an examination. As noted above, not all evidence takes the 
form of documents and files that can be easily viewed on site. .Analyzing 
evidence of how a computer has been used, what it has been used for. and who 
has used it requires considerable lime, and taking that much time on pi^emises 
could be unreasonable. As explained above, because the w^arrant calls for forensic 
electronic evidence, it is exceedingly likely that it. will be necessary to thoroughly 
examine storage media to obtain evidence. Storage media can store a large 
volume of information. Reviewing that mformalion for things described in the 
warrant can take weeks or months, depending on the volume of data stored, and 
would be impracticai and invasive to attempt on-site. 

b. fcchnical requirements. Computers can be configured in several different ways, 
featuring a variety of different openiting systems, application software, and 
coiifiguratiofis. Therefore, searching them sometimes requires tools or knowledge 
that might not be present on ihe search site. The vast array of computer hardware 
and software avadable makes it difficult to know before a seamh what tools or 
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knowledge wifi be requirtsd lo the system aiui hs data on the Premises. 

Iknvever taking the storage media ofT-site and reviewing it in a controlled 
enviironn\cnt will allow Its exammation with the proper tools and kmmJedgc. 


c. Variety of forms of dectron ic media. Records sought under this warmni could be 
stoi^d in a vaj'iety of storage media formats that may require otT-iiite reviewing 
with specialized forensic took. 


to. Niiftfteqf leased on the foregoing, and consistent with Rule 
41(eX2}(B), the warrant! am applying for w’ould pennU seizing, imaging, or otherwise copying 
storage medm ih«i reasonably appear to contain some or ail of the evidence described in the 
w^rranL and wmitd authorize a later review of the media or in form a Ei on consisteni with the 
warrant. 1’he later review may require techniques, inciuding but not limited to computer-assisted 
scans of the entire medium, that might exptsse many pans of a hard drive to huiTian in.speciion in 
order to deiermine whether it is evidence described by the warrant. 


CONCLUSION 


M. 1 submit that this aflTdavit supports probable cause for a wairaiii to search the 

property identified in Anachment A and seize the hems describtx^ in Auachmeuf B. 


Respectfully submitted. 
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Special Agent 

federal Rureau of Uivcsiltiation 
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THE ABOVE AGENT HAD A1TESTED 
1'0 THIS AFFIDAVIT PURSUANT TO 
FED. R. CRIM. P. 4.1(b)(2)(B) THIS 
DAY OF APRIL 2019. 


U,5. Magistrate 
Judge Katherine P. 
Nelson 


Digitally signed by U.S. Magistrate Judge 
Katherine P. Nelson 

DN: cn=U.S. Magistrate Judge Katherine P. 
Nelson^ o=FederaJ Judiddfy, ou=U.S. 
.GoverntYtent, 

cnnaii=efile. nelson&a lsd.uscourts.gov, c^US 
Date; 20i9iM.OS 14:55:44-06W 


KATHERINE P. NELSON 

UNITED S LATES MAGISTRATE .IIJDGE 
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ATTACHMENT A 
Properly to be searched 


he property to be searched are ihe following (hereafter referred to as devices); 


I'ype: 

I,aplop Coinputer 

Make; 

Toshiba 

Model: 

S/N69I69379Q 

Type: 

Laptop Computer 

Make: 

Toshiba 

Model: 

S/N9B28I331K 

Type: 

Cellular telephone 

Make: 

Apple 

Model: 

iPhone lOXS 


This devices are currently located at the FBI Mobile Evidence Control Room located at 200 N. 
Royal Street, Mobile, AL 36603, This warrant authorizes the forensic examination of the devices 
for the purpose oi icieruifying the electronically stored information described in Attachment B. 
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AT t'ACHMEiNT it 


Propi^riy to he sehed 


L All records on ihe devices described in Attachment A rcltiting to Violations of 
1 itic IS U.S.C* § I j4.i. Wire J‘i’aud and Title IS § 1033* Insurance l-Viiijdt tiiosc vtalalions 

itwolvinjiTlioinaB Rdward Burns and/or I cstiimy Biwtis Agency, LLC m6 occurring aftar 
November 8*3016 (the dale in which the Tommy Bums Agency* LLC received its insurance 
license) induding^ 


a* Records and infottrsaiion relating to insurance policies, policy applicaiions. 


cancellation vertices* customer requests Ibr refunds of tliclr policy premiums and 


otiter dkm communication, customer payment informption* financial docunteitls 
showing deposits of client premiums* checks or copies ot checks to/fix^iti dietiLs. 


esciow semces ^tnd insurance undenvritci' information*. 


Recoixls itnd information 


relating to the following e-mail accounts used bv Sums: 
tom my@i ummy b u msagcncy com 

^igmaiLcom: 



@y^liao*co[ni and 


b. Records and information rdaiing io the tracking of payments^ payment logs* 

cancellation notices for non-payment orpremiums* policy applications* requests 

tor refunds of prcmiiuns, receipts for premium payments, invoices for payments* 

documciUs showing deposits of client premiums* checks or copies of checks to or 

from ciictils, escrow sci-viccs, and insurance undcrwriLcrs; 
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c. Records and infonnalion relating to any agreemenis, contracts, or cominunication 
that may exist or existed between Thomas E, Burns and/or Tommy Bums 
Agency, LLC and the individuals/entities identified herein as well as any other 
individual or business who has received a notice of nonpayment or cancellation 
notice due to nonpayment from November K 2018 through the present: 

d. Records and infotmati on re lating to al! customers who had po! i cies q uoted or 
bound til rough Thomas E. Burns and/or Tommy Burns Agency. LLC from 
November 1, 2018 to the present; 

e. Records and information relating to any complaints relating to policies bound or 
tssueti by or through Tommy Burns Agency, LLC from November i. 2018 to the 

■ present. 

2. For any computer or storage medium whose seizure is otherwise authorized bv 
this warrant, and any computer or storage medium that contains or in which is stored records or 
information that is otherwise called for by this warrant (hereinafter. '-COMPUTER"’): 

a. evidence of who used, owned, or control led tlie COM PUTER at the lime the 
things described in this warmnt were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, clocumems. 
browsing history, user profiles, email, email contacts, “chat.” instant messaging 
logs, photographs, and coiTe.spondence; 
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b, evidence of software that would allow others to control the COMPUTER, such as 
viruses, 7Vojan horses, and other forms of malicious software, as well as evidence 
olTbe presence or absence of security software designed to delect malicious 
software; 

c. evidence of the lack of such maffeious software; 

il evidence indicating how and when the computer was accessed or used to 

determine the clironological context of computer access, use, and events unlacing 
to crime under investigation and to the computer user; 

c, evidence indicating the computer user's state of mind as it relates to the crime 
under investigation; 

ft evidence of the atlachmcnt to the COMPUTER of other storage devices or similar 
caniainers for electronic evidence; 

g, evidence of counter-forensic programs (and associated data) that arc designed to 
eliminate data from the COMPUTER; 

h, evidence of the limes the COMPUTER was usett; 

i, passwords, encryption keys, and other access devices that may be necessaiy' to 
access the COMPUTER; 

j, documentation and manuals that may be necessary to access the COMPUTER or 
to conduct a forensic examination of the COMPUTER; 
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k. records of or information about Internet Protocol addresses used by the 
COMPUfERi 

i, records of or information about the COMPUTER'S Internet activity, including 

n re wall logs, caches, browser history and cookies, "bookmarked" or '"favorhe" 
w'cb pag.es, search terms that the user entered into any internet search engine, and 
records of user^typed web addresses; 

m, contextual information necessary to understand the evidence described in this 
attaclmient. 


As used above, the tenns "Veeords'" and "iafoniiation"' includes ail forms of creation or 
storage, including any form of computer or clecironic storage (such as hard disks or other media 
that can store data); any liandmade form (such as writing): any mcchahical form (such as printing 
or typing): and any photographic form (such as microfilm, microfiche, prints, slides, negatives, 
videotapes, motion pictures^ or photocopies). 


I he term "computer" includes all types of electronic, magnetic, optical electrochemical 
or other high speed data processing devices performing logical arithmetic, or storage functions, 
inciudingdesklop computers, notebook computers, mobile phones, tablets, sender computers, and 
network hardware. 


The term "storage medium" includes any physical object upon which computer data can 
be rccoidcd. lixamples include hard disks, RAIvl [loppy disks, flash memory/thumb drives, CT> 
ROMs, and other magnetic or optical media. 
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I hh warrant authorizes a review of electronic storage media and electmnically stored 
intbnnation seized or copied pursuant to this warrant in order to locate evidence, fruits* and 
instrumentalities described in ibis uan^ant. The review^ of this eleetronic data may be conducted 
by any government personnel assisting in the investigation, who may include, in addition to law 
enforcement oHicers and agents, attorneys for the government, attorney support staff and 
leehnica! experts. Pursuant to this wammU the FBi may deliver a complete copy of the seized or 
copied electronic data to the custody and control ol attorneys for the government and their 
suppoit staff for their independent review. 
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